refactor(routing): 暴露 system_locked_domains + 服务端 follow-up 清理(FK/Validate/dedup/exclude单源/共用Store/Builtin保留)

2026-07-29 06:38:52 +08:00
parent 52912268d0
commit 3159dd75c1
11 changed files with 285 additions and 36 deletions
@@ -65,7 +65,7 @@ func doAuthReq(t *testing.T, method, target string, body *strings.Reader, uid in
 func TestRoutingGetDefaultThenSave(t *testing.T) {
 	db := openRoutingTestDB(t)
 	seedRoutingUser(t, db, 7)
-	api := NewRoutingAPI(routing.NewStore(db))
+	api := NewRoutingAPI(routing.NewStore(db), nil)

 	// GET 无档案 → 200 + Default
 	rr := doAuthReq(t, http.MethodGet, "/v1/me/routing", nil, 7, api.GetProfile)
@@ -120,7 +120,7 @@ func TestRoutingGetDefaultThenSave(t *testing.T) {

 func TestRoutingGetUnauthorized(t *testing.T) {
 	db := openRoutingTestDB(t)
-	api := NewRoutingAPI(routing.NewStore(db))
+	api := NewRoutingAPI(routing.NewStore(db), nil)
 	req := httptest.NewRequest(http.MethodGet, "/v1/me/routing", nil)
 	rr := httptest.NewRecorder()
 	api.GetProfile(rr, req)
@@ -128,3 +128,82 @@ func TestRoutingGetUnauthorized(t *testing.T) {
 		t.Fatalf("expected 401, got %d", rr.Code)
 	}
 }
+
+// TestRoutingGetExposesSystemLockedDomains: GET must surface the injected
+// lockedDomains list under system_locked_domains, without it ever ending up
+// as part of routing.Profile's own field set.
+func TestRoutingGetExposesSystemLockedDomains(t *testing.T) {
+	db := openRoutingTestDB(t)
+	seedRoutingUser(t, db, 8)
+	api := NewRoutingAPI(routing.NewStore(db), []string{"nas.x.com"})
+
+	rr := doAuthReq(t, http.MethodGet, "/v1/me/routing", nil, 8, api.GetProfile)
+	if rr.Code != 200 {
+		t.Fatalf("GET code %d", rr.Code)
+	}
+	var resp struct {
+		SystemLockedDomains []string `json:"system_locked_domains"`
+	}
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(resp.SystemLockedDomains) != 1 || resp.SystemLockedDomains[0] != "nas.x.com" {
+		t.Fatalf("want system_locked_domains=[nas.x.com], got %v", resp.SystemLockedDomains)
+	}
+}
+
+// TestRoutingGetSystemLockedDomainsNilBecomesEmptyArray: a nil lockedDomains
+// slice (no PANGOLIN_PRIVATE_SPLIT_DOMAINS configured) must serialize as
+// `[]`, not `null` — clients shouldn't need a nil-check.
+func TestRoutingGetSystemLockedDomainsNilBecomesEmptyArray(t *testing.T) {
+	db := openRoutingTestDB(t)
+	seedRoutingUser(t, db, 9)
+	api := NewRoutingAPI(routing.NewStore(db), nil)
+
+	rr := doAuthReq(t, http.MethodGet, "/v1/me/routing", nil, 9, api.GetProfile)
+	if rr.Code != 200 {
+		t.Fatalf("GET code %d", rr.Code)
+	}
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(rr.Body.Bytes(), &raw); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if got := string(raw["system_locked_domains"]); got != "[]" {
+		t.Fatalf("want system_locked_domains=`[]`, got %s", got)
+	}
+}
+
+// TestRoutingSaveIgnoresSystemLockedDomains: a client POSTing a body that
+// includes system_locked_domains must not have it persisted — SaveProfile
+// decodes straight into routing.Profile, which has no such field, so the
+// key is silently dropped. Verify against the raw stored row (not the GET
+// response, which always injects it from a.lockedDomains regardless of what
+// was ever saved).
+func TestRoutingSaveIgnoresSystemLockedDomains(t *testing.T) {
+	db := openRoutingTestDB(t)
+	seedRoutingUser(t, db, 10)
+	store := routing.NewStore(db)
+	api := NewRoutingAPI(store, []string{"nas.x.com"})
+
+	body := `{"mode":"rule","builtin":{"china_direct":true,"lan_direct":true,"private_via_tunnel":true},` +
+		`"rules":[],"final":"proxy","system_locked_domains":["evil.attacker.com"]}`
+	rr := doAuthReq(t, http.MethodPost, "/v1/me/routing", strings.NewReader(body), 10, api.SaveProfile)
+	if rr.Code != 200 {
+		t.Fatalf("POST code %d body %s", rr.Code, rr.Body)
+	}
+
+	stored, err := store.Get(context.Background(), 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if stored == nil {
+		t.Fatal("expected a persisted profile")
+	}
+	raw, err := json.Marshal(stored)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(raw), "system_locked_domains") || strings.Contains(string(raw), "evil.attacker.com") {
+		t.Fatalf("system_locked_domains must never be persisted, got stored profile JSON: %s", raw)
+	}
+}